Alerting on the existence of a file with wildcards
I've successfully tested monitoring for the appearance of a statically defined file (i.e. no wildcards), and have been happy with the result.
I'm now tasked with trying to alarm on the appearance of file where only part of the filename will be static, hence the need for wildcards.
I'm at the point where the presence of a file causes a green condition, and the removal of that file causes a white condition.
The client-local.cfg is set up to look like this (the commented lines are my various attempts to test/change the behavior):
file:find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r
#file:find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r | head -n 1
#file:find /opt/WSCluster1/WebSphere/wp_profile | grep javacore | sort -r | head -n 1
#file:find /opt/WSCluster2/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1
#file:find /opt/WSCluster3/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1
log:/var/adm/syslog/syslog.log:10240
The analysis.cfg is set up like so (again, commented lines are my attempts to test/change the behavior):
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.) yellow
NOEXIST
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
yellow
I've put a test file out, /opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is reporting green on the file's existence...which, of course, is not the desired behavior.
My guess is that I'm completely bollixing the regex...any thoughts or help would be appreciated.
--
Mike Burger
AIX Administrator
<http://freedomhome.fhmc.local/intranet/main.jsp>
Phone (317) 537-3680, Fax (317) 537-4680, Cell (317) 797-2040
E-mail: Mike.Burger at FreedomMortgage.com <mailto:Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
I'm guessing the same. The "^" means to tie to the start of the string, which makes no sense unless it's at the start of the string. Try something like this:
FILE /opt/WSCluster1/WebSphere/wp_profile/%^javacore yellow NOEXIST
Note that the regex "^javacore" will match anything starting with "javacore" no matter what follows. It's as if there's an implied wildcard at the end.
J
On 29 December 2012 01:04, Michael Burger <Mike.Burger at freedommortgage.com>wrote:
I’ve successfully tested monitoring for the appearance of a statically defined file (i.e. no wildcards), and have been happy with the result.****
I’m now tasked with trying to alarm on the appearance of file where only part of the filename will be static, hence the need for wildcards.****
I’m at the point where the presence of a file causes a green condition, and the removal of that file causes a white condition.****
The client-local.cfg is set up to look like this (the commented lines are my various attempts to test/change the behavior):****
file:
find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r
#file:
find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r | head -n 1****#file:
find /opt/WSCluster1/WebSphere/wp_profile | grep javacore | sort -r | head -n 1****#file:
find /opt/WSCluster2/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1****#file:
find /opt/WSCluster3/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1****log:/var/adm/syslog/syslog.log:10240****
The analysis.cfg is set up like so (again, commented lines are my attempts to test/change the behavior):****
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.) yellowNOEXIST****
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow****
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.) yellow
I’ve put a test file out, /opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is reporting green on the file’s existence…which, of course, is not the desired behavior.
My guess is that I’m completely bollixing the regex…any thoughts or help would be appreciated.****
--****
*Mike Burger*****
*AIX Administrator*
*[image: cid:image001.gif at 01CC72C8.834C1990]*<http://freedomhome.fhmc.local/intranet/main.jsp>
*Phone (317) 537-3680**, **Fax** **(317) 537-4680, Cell (317) 797-2040 ***
*E-mail: **Mike.Burger at FreedomMortgage.com*<Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts****
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Michael,
Regular expressions must be specified for the entire match, so the following is probably closer to the mark:
FILE %/opt/WSCluster.*/WebSphere/wp_profile/javacore yellow NOEXIST
In the client-local.cfg you can probably try an alternative also:
file:find /opt/WSCluster*/WebSphere/wp_profile -type f -name javacore* | sort -r
David.
I’ve successfully tested monitoring for the appearance of a statically defined file (i.e. no wildcards), and have been happy with the result.
I’m now tasked with trying to alarm on the appearance of file where only part of the filename will be static, hence the need for wildcards.
I’m at the point where the presence of a file causes a green condition, and the removal of that file causes a white condition.
The client-local.cfg is set up to look like this (the commented lines are my various attempts to test/change the behavior):
file:
find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r#file:
find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r | head -n 1#file:
find /opt/WSCluster1/WebSphere/wp_profile | grep javacore | sort -r | head -n 1#file:
find /opt/WSCluster2/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1#file:
find /opt/WSCluster3/WebSphere/wp_profile | grep javacore > /dev/null | sort -r | head --lines=1log:/var/adm/syslog/syslog.log:10240
The analysis.cfg is set up like so (again, commented lines are my attempts to test/change the behavior):
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.)yellow NOEXIST
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow
FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.) yellow
I’ve put a test file out, /opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is reporting green on the file’s existence…which, of course, is not the desired behavior.
My guess is that I’m completely bollixing the regex…any thoughts or help would be appreciated.
--
*Mike Burger*
*AIX Administrator*
*cid:image001.gif at 01CC72C8.834C1990* <http://freedomhome.fhmc.local/intranet/main.jsp>
*Phone (317) 537-3680**, **Fax****(317) 537-4680, Cell (317) 797-2040 ***
*E-mail: **Mike.Burger at FreedomMortgage.com* <mailto:Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
-- David Baldwin - Senior Systems Administrator (Datacentres + Networks) Information and Communication Technology Services Australian Sports Commission http://ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au
This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
I'll give it a try...thank you both very much.
--
Mike Burger
AIX Administrator
<http://freedomhome.fhmc.local/intranet/main.jsp>
Phone (317) 537-3680, Fax (317) 537-4680, Cell (317) 797-2040
E-mail: Mike.Burger at FreedomMortgage.com <mailto:Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] Sent: Tuesday, January 01, 2013 11:02 PM To: David Baldwin Cc: Michael Burger; xymon at xymon.com Subject: Re: [Xymon] Alerting on the existence of a file with wildcards
On 2 January 2013 14:10, David Baldwin <david.baldwin at ausport.gov.au> wrote:
Regular expressions must be specified for the entire match
Doh! Yes, what he said. I parsed the strings starting at the percent. Oops.
J
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
Here's what finally worked for generating the alarms:
FILE %/opt/WSCluster.*/WebSphere/wp_profile/javacore.* yellow NOEXIST
I believe that the .* after "WSCluster" was terminating the initial regex, as what I was seeing was the same behavior (white with files not found, green when the files existed). Setting "javacore" to "javacore.*" as well generated the yellow alarms I was looking for.
--
Mike Burger
AIX Administrator
<http://freedomhome.fhmc.local/intranet/main.jsp>
Phone (317) 537-3680, Fax (317) 537-4680, Cell (317) 797-2040
E-mail: Mike.Burger at FreedomMortgage.com <mailto:Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Michael Burger Sent: Wednesday, January 02, 2013 7:55 AM To: Jeremy Laidman; David Baldwin Cc: xymon at xymon.com Subject: Re: [Xymon] Alerting on the existence of a file with wildcards
I'll give it a try...thank you both very much.
--
Mike Burger
AIX Administrator
<http://freedomhome.fhmc.local/intranet/main.jsp>
Phone (317) 537-3680, Fax (317) 537-4680, Cell (317) 797-2040
E-mail: Mike.Burger at FreedomMortgage.com <mailto:Anthony.House at freedommortgage.com>
"Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] Sent: Tuesday, January 01, 2013 11:02 PM To: David Baldwin Cc: Michael Burger; xymon at xymon.com Subject: Re: [Xymon] Alerting on the existence of a file with wildcards
On 2 January 2013 14:10, David Baldwin <david.baldwin at ausport.gov.au> wrote:
Regular expressions must be specified for the entire match
Doh! Yes, what he said. I parsed the strings starting at the percent. Oops.
J
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
participants (3)
-
david.baldwin@ausport.gov.au
-
jlaidman@rebel-it.com.au
-
Mike.Burger@FreedomMortgage.com